The Shrinking, Smarter DDoS Problem
Cloudflare's DDoS protection now covers every plan tier — from free WordPress blogs to global enterprise network infrastructures — across Layers 3 through 7. The company observes attack traffic across more than 26 million Internet properties, which makes the identification of small, stealthy attacks at Layer 7 especially challenging. The patterns of attack activity, however, have shifted in notable ways.
In recent months, the proportion of network-layer attacks peaking above 30 Gbps has declined sharply. From September 2019 to March 2020, large attacks dropped by 82%, and in March 2020, over 95% of attack traffic peaked below 30 Gbps. The average attack size simultaneously shrank by 53% to roughly 11.88 Gbps. Big floods haven't vanished — sustained peaks around 330 Gbps and up to 400 million packets per second still occur — but they are more the exception than the rule.
As attacks got smaller, they got more concentrated. Instead of dispersing across Cloudflare's Anycast network, many floods now originate from within the catchment of one or two specific data centers. This hyper-localized pattern makes detection harder at a global scale, because the attack signal becomes diluted when samples are aggregated from all data centers.
Two Systems, One Defense
Cloudflare's older automated mitigation system, Gatebot, is a centralized analysis engine. It ingests flow data and HTTP request samples from routers and servers, detects anomalies in its core data centers, and pushes mitigation rules to the edge. Gatebot still handles very large attacks — on average it stops over 4,000 L3/L4 attacks monthly — but its centralized model struggles to spot small, localized floods.
That gap drove development of a complementary daemon, dosd, which runs on every server in every data center. Each instance analyzes and mitigates independently, without contacting a central core. The system is decentralized, faster, and lighter on CPU and memory. In its most recent month alone, dosd handled 281,746 L3/L4 attacks — roughly 55 times the volume Gatebot dropped in the same period — by catching small floods that previously escaped central notice. dosd's mitigation speed typically falls in the 0–3 second range. Detected attacks get rule-based mitigation at the local data center; Gatebot can still push higher-priority rules applicable across the entire global fleet into the scheme.
When an emergency flood triggers dosd at a single location, Gatebot's global sampling can later define network-wide mitigations that override the local rules when needed.
Where the Direction Changed at L7
Two notable attacks, both in 2019, pushed L7 mitigation engineering forward. They were not necessarily the largest floods observed, but they exposed where response efficiency could be improved.
Example #1: Distributed assault with real clients
In July 2019, an HTTP DDoS attack peaked at 1.4 million requests per second across nearly 1.1 million unique, non-spoofed IP addresses. Because these were actual clients completing TCP and TLS handshakes, mitigation meant dealing with genuine traffic — and that incurred real costs in terms of network and computational response.
Example #2: Sustained rate from a narrow source set
In September 2019, another attack peaked just below 5 million requests per second and stayed there for over an hour. The sustained rate came from only 371K non-spoofed, unique IP addresses, indicating a strategic concentration on throughput efficiency rather than wide distribution.
These examples highlighted where computational burden could be cut. When the attack rate stays up and sources stay numerous, responding to requests at the web-server level consumes CPU and bandwidth unnecessarily.
IP Jails: Moving Mitigation Down the Stack
Rather than respond to attacking IPs at the application layer with JavaScript blocks, CAPTCHAs, or rate-limit pages, Cloudflare introduced a Gatebot capability called IP Jails. When attack traffic exceeds a set request rate threshold, the gateway change repositions the defense down from L7 to L4 for that attacking IP set. Instead of constructing responses, edge servers simply drop the connection and TCP-level packets — dramatically lowering resource use:
The attack traffic rate dropped sharply once IPs were jailed, and CPU usage over response mitigation returned precisely to normal residual usage after the switchover — in both cases, network responses previously generated at the L7 layer were cut by roughly a factor of 10.
Catching Low-Rate Floods with Origin Feedback
Attacks that exceed a million requests per second appear, however rare, far less frequently than low-level floods that pass under many detection systems. Small floods can reach origin infrastructure that has been downsized for normal traffic loads — such traffic spikes can come from excited good bots or faulty client applications rarely being a targeted attack — but the practical effect, though lacking malicious intent, remains an origin outage.
To catch those, Gatebot has been given an adaptive feedback signal: when an origin server's error rate spikes in the 500 range (HTTP 500 internal server errors), Gatebot compares the current rate against the average baseline error rate, and when the anomaly triggers, it automatically propagates ephemeral mitigation rules to the edge data centers, using block (403), rate limit (429), or challenge actions where confidence allows. This capability protects all Cloudflare customers regardless of plan, including the free tier, and is enabled by default.
In March 2020, that approach — alongside other L7 detection avenues — produced an average of 812 L7 HTTP DDoS mitigations per day, roughly 20,000 total mitigations for the month.
More visibility tools have been added parallel to these systems. Network Analytics now exposes both L3/L4 attacks handled by both Gatebot and dosd for Magic Transit and BYOIP customers, and Firewall Analytics lets WAF/CDN customers see L7 attack traffic. Both are part of Cloudflare's standard offering across every plan, with no additional charges.
